linkisGHSA-j6vx-r77h-44wc
Apache Linkis arbitrary file deletion vulnerability
High4.9CVE-2024-27182 · Published Aug 2, 2024 · updated Mar 27, 2025
In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on a user with an administrator account could delete any file accessible by the Linkis system user. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.linkis:linkis Maven | < 1.6.0 | 1.6.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-552
- Also known as
- CVE-2024-27182
More linkis advisories
All linkis| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 19 | Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass High7.5Jan 19 | High7.5 | 1.8.0 |
| Aug 22024 | Apache Linkis vulnerable to privilege escalationHigh5.3Aug 2, 2024 | High5.3 | 1.6.0 |
| Mar 62024 | Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedMedium5.3Mar 6, 2024 | Medium5.3 | 1.5.0 |
| Jul 62023 | Apache Linkis Authentication Bypass vulnerabilityCritical9.1Jul 6, 2023 | Critical9.1 | 1.3.2 |
| Jul 62023 | Apache Linkis Zip Slip issueCritical9.8Jul 6, 2023 | Critical9.8 | 1.3.2 |
| Jul 62023 | Apache Linkis Unrestricted File Upload vulnerabilityCritical9.8Jul 6, 2023 | Critical9.8 | 1.3.2 |